@ethernity-cloud/sdk-js 1.1.1 → 1.4.0

package/build.js

@@ -1,7 +1,36 @@
 const { execSync } = require('child_process');
+const fs = require('fs');
 const path = require('path');
 require('dotenv').config();
 
+// Increment VERSION on every build, mirroring the Python SDK's build.py
+// (config VERSION += 1). VERSION is the immutable per-build registry channel and
+// the enclave-name suffix, so each build must advance it. Existing projects seed
+// VERSION as "v1"; parse whatever trailing integer is present (v1 -> 1, 22 -> 22,
+// empty -> 0), increment, and persist as a plain integer. It must never equal
+// "v3" (the protocol channel that acts as the moving "latest" pointer); plain
+// integers can't collide with the "v3" string, so this is safe.
+const writeEnv = (key, value) => {
+    const envFile = '.env';
+    let content = fs.existsSync(envFile) ? fs.readFileSync(envFile, 'utf8') : '';
+    const regex = new RegExp(`^${key}=.*`, 'm');
+    if (regex.test(content)) content = content.replace(regex, `${key}=${value}`);
+    else content += (content && !content.endsWith('\n') ? '\n' : '') + `${key}=${value}`;
+    fs.writeFileSync(envFile, content, 'utf8');
+};
+
+const bumpVersion = () => {
+    const raw = (process.env.VERSION || '0').toString();
+    const digits = raw.match(/\d+/);
+    const next = (digits ? parseInt(digits[0], 10) : 0) + 1;
+    process.env.VERSION = String(next);
+    writeEnv('VERSION', String(next));
+    console.log(`Version incremented to ${next}`);
+    return next;
+};
+
+bumpVersion();
+
 const serviceType = process.env.SERVICE_TYPE;
 
 if (serviceType === "Nodenithy") {

package/init.js

@@ -204,7 +204,7 @@ const main = async () => {
       ),
     );
   } else {
-    customUrl = "http://ipfs.ethernity.cloud:5001";
+    customUrl = "https://ipfs.ethernity.cloud";
   }
 
   fs.mkdirSync("src/serverless", { recursive: true });

package/nodenithy/build/securelock/Dockerfile.tmpl

@@ -6,7 +6,6 @@ RUN cd /
 
 RUN apk add bash
 
-ENV SCONE_MODE=SIM
 ENV SCONE_HEAP=256M
 ENV SCONE_LOG=DEBUG
 ENV ENCLAVE_NAME_SECURELOCK=__ENCLAVE_NAME_SECURELOCK__
@@ -50,14 +49,31 @@ RUN apk add openssl
 
 RUN openssl genrsa -3 -out /enclave-key.pem 3072
 
-
-ENV SCONE_LOG=info
+# SCONE runtime env. These MUST match the enclave-creation params passed to
+# scone-signer below (SCONE embeds defaults for anything not signed explicitly;
+# any drift makes SCONE recompute + debug re-sign the enclave at load, which CAS
+# rejects on mainnet). Values mirror the publish/run docker-compose securelock
+# service (SCONE_HEAP=1024M, SCONE_STACK=4M, dlopen=1, extensions=libbinary-fs).
 ENV SCONE_HEAP=1024M
+ENV SCONE_STACK=4M
 ENV SCONE_ALLOW_DLOPEN=1
 ENV SCONE_EXTENSIONS_PATH=/lib/libbinary-fs.so
 
-# Enable production mode for mainnet
-# RUN scone-signer sign --key=/enclave-key.pem --env --production /usr/bin/node
+# Rendered by build.mjs. Signs the EXECUTED binary (/usr/local/bin/node -- the
+# ENTRYPOINT and the run/publish compose command both run /usr/local/bin/node).
+# Mainnet adds --production (CAS/DCAP attestation); testnet omits it (non-CAS
+# self-sign). On testnet builds this line is a no-op comment.
+__SCONE_SIGN__
+
+# Record the SIGNED MRENCLAVE so publish (run.js) can assert the runtime enclave
+# measurement matches what was signed BEFORE registering the CAS session /
+# publishing. A mismatch means SCONE recomputed the enclave at load (params
+# drift) => debug re-sign => CAS rejects the DCAP quote on mainnet. Only produced
+# for --production (mainnet) signs; on testnet the file is absent and the check
+# is skipped. Capture to a file first: piping scone-signer into `head` kills it
+# with SIGPIPE (exit 141) under buildkit's pipefail shell.
+__SIGNED_MRENCLAVE__
+
 RUN rm -rf /enclave-key.pem
 
 #RUN scone cas attest scone-cas.cf 3061b9feb7fa67f3815336a085f629a13f04b0a1667c93b14ff35581dc8271e4 -GCS --only_for_testing-debug --only_for_testing-ignore-signer

package/nodenithy/build/securelock/src/README-keygen.md

@@ -0,0 +1,41 @@
+# SGX key-gen module (`sgx_report.node`)
+
+The JS SDK ships this module **only as a prebuilt N-API addon**
+(`sgx_report.node`) — never the C source (`get_sgx_report.c`,
+`sgx_report_napi.c`). The identity-key derivation (SGX EREPORT + obfuscated
+MR_SIGNER + HKDF-SHA512 domain-separated derivation) lives entirely in the
+compiled binary, so a developer inspecting the package or build tree never sees
+the algorithm. `get_sgx_report.c` and `sgx_report_napi.c` are gitignored here
+so they can never be committed.
+
+## Where the source lives
+
+The source of truth is the runtime repo, not this package:
+
+- `etny-nodenithy` → `v3/build/{securelock,trustedzone,validator}/src/`
+  (`get_sgx_report.c` + `sgx_report_napi.c`)
+
+## How the `.node` is produced
+
+`sgx_report.node` is a **build artifact of the etny-nodenithy pipeline** — its
+Dockerfile compiles `sgx_report_napi.c` (which `#include`s `get_sgx_report.c`)
+into the addon with a single gcc command against node's `node_api.h`. To refresh
+the copy the SDK ships, take the `sgx_report.node` that pipeline produces and
+commit it here as `securelock/src/sgx_report.node`.
+
+The JS wrappers `sgx_report.js` (loader) and `self_sign.js` (calls
+`deriveIdentityScalar`) ship as source — they contain no algorithm, only calls
+into the addon.
+
+## Why not compile it in the SDK build
+
+The securelock Dockerfile bakes `src/` into binary-fs but does **not** compile
+the addon, so the SDK must carry the prebuilt `.node`. `build.mjs` fails fast if
+`src/sgx_report.node` is missing.
+
+## Honest scope
+
+This hides the SOURCE, not the algorithm: the `.node` still contains the
+executable logic and the enclave image is public. On testnet (no attestation)
+the derived key is reproducible by anyone who runs the image. Key exclusivity
+comes from attestation, not from shipping only the binary.

package/nodenithy/build/securelock/src/etny_exec.js

@@ -2,34 +2,62 @@ const fs = require('fs');
 const path = require('path');
 const { TaskStatus } = require('./task_status');
 
-// Load all JavaScript files from the ./serverless/ folder
-// const serverlessDir = path.join(__dirname, './serverless');
-
-// let backendFunctions = {};
-// fs.readdirSync(serverlessDir).forEach(file => {
-//     if (file.endsWith('.js')) {
-//         const filePath = path.join(serverlessDir, file);
-//         const moduleExports = require(filePath.replace('.js', ''));
-//         backendFunctions = { ...backendFunctions, ...moduleExports };
-//     }
-// });
-const { hello } = require('./serverless/backend');
+// Load EVERY export of ./serverless/backend into the payload's scope. The
+// backend is copied next to this file by ecld-build (and staged the same way
+// by ecld-test locally), so one code path serves both the enclave and local
+// testing. Previously only a function literally named `hello` was reachable
+// (hardcoded destructure); any other exported function threw ReferenceError.
+// A missing backend leaves only ___etny_result___ in scope, which is the
+// stock-enclave behaviour.
+let backendFunctions = {};
+// If the backend fails to load, remember WHY. A silently-swallowed failure
+// (missing npm module, bad require inside backend.js) makes every task die
+// later with a misleading "X is not defined". Only a genuinely absent backend
+// stays silent — that is the stock-enclave configuration.
+let backendImportError = null;
+try {
+    backendFunctions = { ...require('./serverless/backend') };
+} catch (e) {
+    backendFunctions = {};
+    // MODULE_NOT_FOUND messages embed the whole require stack (which always
+    // mentions serverless/backend.js), so parse out WHICH module is missing:
+    // only a missing backend module itself means "no backend shipped".
+    const m = /Cannot find module '([^']+)'/.exec(e.message || '');
+    const missingBackendItself =
+        e.code === 'MODULE_NOT_FOUND' && m && /serverless[\\/]backend/.test(m[1]);
+    if (!missingBackendItself) {
+        backendImportError = `${e.name || 'Error'}: ${(e.message || '').split('\n')[0]}`;
+    }
+}
 
 function ___etny_result___(data) {
     return [0, data];
 }
+
 function executeTask(payload, input) {
-    return exec(payload, input, { '___etny_result___': ___etny_result___, 'hello': hello });
+    if (backendImportError !== null) {
+        return [
+            TaskStatus.IMPORT_ERROR,
+            'BACKEND IMPORT ERROR: ' + backendImportError +
+            ' | The serverless backend failed to load inside the enclave, so none of its' +
+            ' functions are available. Common causes: a module missing from the enclave' +
+            ' image dependencies, or a bad require() inside backend.js.'
+        ];
+    }
+    return exec(payload, input, { '___etny_result___': ___etny_result___, ...backendFunctions });
 }
+
 function exec(payload, input, globals = null) {
     try {
         if (payload && payload !== "") {
+            const scope = globals || {};
             if (input && input !== "") {
-                if (globals) {
-                    globals['___etny_data_set___'] = input;
-                }
-                return ___etny_result___(eval(payload));
-            } else {
+                scope['___etny_data_set___'] = input;
+            }
+            // `with` exposes every backend function and ___etny_data_set___ to
+            // the payload by bare name — matching how payloads are written
+            // (e.g. `processData(___etny_data_set___)`).
+            with (scope) {
                 return ___etny_result___(eval(payload));
             }
         } else {